World

Apple's clash with the FBI will be a tough legal fight

A federal judge in California has ordered Apple to build software to help federal investigators bypass an iPhone's security features. Apple CEO Tim Cook said the company &quot;oppose[s]&quot; the order.

Apple may face an uphill climb in its latest fight with the feds over digital privacy.

The company's CEO, Tim Cook, said in a statement on its website Wednesday that Apple opposes a federal court's order to write special software so federal investigators can penetrate the passcode for an iPhone once used by Syed Farook.

Farook and his wife, Tashfeen Malik, were the perpetrators of a shooting spree in San Bernardino, Calif., on Dec. 2, which killed 14 people and injured 22 others. The shooters were later killed during a gunfight with police.

Agents from the Federal Bureau of Investigation and lawyers from the Justice Department have said Farook's phone, and iPhone 5C, may contain key evidence about his communications in the weeks before the attack, but they cannot access it without Farook's passcode.

FBI agents have been unable to access the phone's contents because of security features built into the device's software. Those include one that forces users to wait several minutes before entering different passcodes. Another erases a decryption key necessary to access the device's data if a user enters a wrong passcode too frequently.

The judge's order instructs Apple to write custom software, called a "Software Image File," to bypass these security features so the FBI can quickly test an unlimited number of passcodes until it finds the right one. Once that as-yet-uncreated software is installed on the phone, security experts say it would take no more than a day to find the code.

News of the order triggered fierce debate last week as technologists wondered whether Apple can, as a matter of technical ability, comply with the demand, while privacy advocates said engineering such software could have dangerous security implications. Legal experts said it raises constitutional questions about how far the government can go when conscripting private, third parties to assist with law enforcement.

Cook's statement, which indicated the company planned to fight the order in court, prompted the Justice Department to file a new motion on Friday, asking Pym to compel Apple to comply with her previous order.

While Apple has not responded formally, Friday's filing and records from a similar case, in a Brooklyn federal court, offer clues about how the looming legal battle may play out.

David Bowdich, the assistant director in charge of the FBI's Los Angeles office, speaks at a news conference at the San Bernardino Police Department on Tuesday, Jan. 5, 2016.

Image: Rachel Luna/The Sun/Associated Press

The other phone

In the Brooklyn case, the FBI and Drug Enforcement Administration sought Apple's help to access an iPhone 5 belonging to Jun Feng, a Queens man charged with possessing and conspiring to sell methamphetamine in 2014. As with the San Bernardino case, the FBI obtained a search warrant to inspect Feng's phone but was unable to get past Apple's security software.

Both cases hinge on a 227-year-old statute called the All Writs Act, which serves, essentially, as a last resort for federal judges to enforce the law.

While critics have mocked the Justice Department for relying on a two-century-old statute to seek Apple's help, prosecutors have said they regularly use the AWA orders for such cases.

In fact, the San Bernardino and Brooklyn cases are just two of at least 70 instances where the government has sought AWA orders compelling Apple to help authorities access evidence on locked or encrypted smartphones, or "target" devices, that it manufactures and sells. A prosecutor in the Brooklyn case first revealed that figure publicly during a hearing in October.

Congress has updated the AWA several times since it first passed as part of the Judiciary Act of 1789, which established the country's federal court system.

"Some call it antiquated," said Saritha Komatireddy, the Feng prosecutor, during the October hearing. "It's actually foundational."

Its seminal interpretation comes from the Supreme Court's 1977 ruling in United States v. New York Telephone Co. In that case, the FBI sought help from a local telephone utility to install a pen register, a device that gathers call records, to obtain evidence of an illegal gambling operation.

The New York Telephone court sided with the FBI and helped establish a three-part test to determine when judges can issue AWA orders to force third parties to assist law enforcement. The test includes:

Whether other means exist to help achieve the government's goal,

The third party's (Apple, in the present cases) relationship to the issue-at-hand, and

Whether an AWA order would unreasonably burden the third party.

In the Apple cases, according to experts and court records, all three questions may be in play.

A last-ditch effort

Since AWA orders are a last resort, the government's requests raise key questions about whether investigators can access the evidence on locked devices — or Apple's help — in other ways.

During the October hearing in Brooklyn, the judge in that case, James Orenstein, pressed prosecutors on that issue.

"Could you subpoena or use some other form of court process — a warrant, perhaps an All Writs Act order — to have Apple disclose to you how to get the information from the phone?" Orenstein asked.

One avenue, he suggested, was subpoenaing Apple engineers to testify before a Grand Jury about how Apple would access locked devices, essentially walking prosecutors through how to do it themselves.

"What you need is the knowhow to get to this phone," Orenstein said.

He also asked whether prosecutors could consult intelligence agencies, such as the National Security or Central Intelligence agencies, about methods they may have secretly developed for accessing locked devices.

Legal experts told Mashable that whether the AWA applies may be a key issue in the San Bernardino case, because Pym's order doesn't just force Apple to give agents access to its information, tools or facilities — it requires Apple to create something new altogether, which Apple has said exceeds the scope of its business.

"That's uncharted territory," said Valerie Barreiro, a law professor at the University of Southern California.

Relationship to target phones

Apple's relationship to the devices in question may be a murkier matter.

That issue takes its cue from United States v. Hall, a 1983 case from Virginia, where a federal court compelled Citibank to provide a fugitive's credit card records. In that case, the court authorized an AWA order because Citibank was still extending credit to the suspect.

Apple has tried to distance itself from the target phones, arguing that it merely manufactured and sold the devices.

But Feng prosecutors have argued that Apple's strict control over the devices' software means it continues to provide services long after its phones are sold, especially because Apple, technically, only leases its software to customers.

"Apple cannot reap the legal benefits of licensing its software in this manner and then later disclaim any ownership or obligation to assist law enforcement when the same software plays a critical role in thwarting execution of a search warrant," prosecutors wrote in a brief.

"They're definitely trying to create a public policy argument," Barreiro said. "'You own and you license the software, which is then used to facilitate a criminal enterprise; You can't turn a blind eye to what is done with that [software],'"

"It's an ongoing relationship because you're not just creating a product," she added. "You're creating a service and that service is ongoing, so you can't separate yourself from that."

Apple's lawyers balked, responding in a brief that its "licensing agreement does not establish a connection between Apple and the private data its customers store on their devices."

People walk outside the Apple store on the Fifth Avenue in New York on February 17, 2016.

Image: Kena Betancur/AFP

Unreasonable burden

If the courts agree that Apple is the FBI's only hope and related closely enough to the target devices, there's still a third question to sort out: Whether helping the FBI would be unreasonably burdensome.

"The courts have typically considered factors such as cost and capability to determine whether or not [an AWA order] is burdensome," Barreiro said.

But as a leading technology company, the software's developer and one of the most cash-rich operations in the world, Apple may be hard-pressed to make its case for burden.

"I don't think they can make the argument that this is technologically prohibitive or cost-prohibitive," Barreiro said.

Instead, in the Brooklyn case, Apple has argued that cooperating with the FBI would burden the company by "threaten[ing] the trust between Apple and its customers" and "substantially tarnish[ing] the Apple brand."

"Public sensitivity to issues regarding digital privacy and security is at an unprecedented level," Apple lawyers wrote in a brief. "This reputational harm could have a longer term economic impact."

But Orenstein, the judge, seemed unpersuaded.

"As you have taken pains to make clear," he told Apple's lawyer, Marc Zwillinger, at the October hearing, "you only break into one of these phones if you're compelled by law. Well, we all have an obligation to follow the law. So how does that imperil the trust consumers have?"

"You have had apparently 70 prior instances where you have not taken the steps available to you [to fight a court order]," Orenstein continued. "That, I can see, imperils [consumers'] trust. But complying with an order after you fight it — how is that going to do it?"

Proving burden may be especially difficult in the San Bernardino case, since the judge gave Apple tremendous flexibility in how to comply.

Apple, Pym's order said, can either: Provide the custom software to the FBI, run the software at an Apple facility, or devise an "alternate" and mutually agreeable way to help agents access the phone.

"One of the things that's admirable about the court order is it's really as narrowly construed as it can be," Barreiro said. "The court has attempted to make this applicable only to this phone and to give Apple an opportunity to try to find an alternate means."

Separation of powers

News of the San Bernardino order touched off a heated debate about the precedent it may set and whether the issue should be decided in courts or through legislation.

While prosecutors argued the requested software would be uniquely tailored to Farook's phone, critics pointed out the process could be repeated for other devices in other cases.

They also worry about precedent, although AWA orders have traditionally required a case-by-case analysis and opinions from federal district judges, such as Pym and Orenstein, are not binding outside their jurisdictions.

The government has argued that, absent an explicit prohibition by Congress to use AWA orders in this way, judges are free to do so.

Critics, including the American Civil Liberties Union, which filed a friend-of-the-court brief in the Brooklyn case, and Barreiro disagree.

"If we're going to do this, it should be through legislation," Barreiro said. "Not through interpretation and not through the contorting of this act."

In its Feng brief, the ACLU argued that a constitutional issue is also at stake. Specifically, to what extent does the Fifth Amendment allow government to conscript third parties into helping law enforcement before violating their rights to liberty?

"What the government is asking Apple to do is undermine a fundamental part of what it offers, which is secure communication," Esha Bhandari, a staff attorney with the ACLU, told Mashable.

"If it can no longer do that because the government has forced it to build malware, for example, that undermines its very business enterprise and what it's offering," she explained.

Bhandari said that until Congress gives courts or law enforcement explicit authority to forcibly enlist third parties in this way, they should not do so.

Congress has, in recent years, considered legislation that would require device-makers to build so-called "backdoors" and help law enforcement agencies access target devices.

Sens. Richard Burr, R-N.C., and Dianne Feinstein, D-Calif., who chair the Senate Select Committee on Intelligence, have indicated support for such legislation. The Obama administration had also supported such legislation, but recently shelved its plans to "seek a legislative remedy" on the issue.

Supporters say a solution is necessary for law enforcement to keep up with criminals as they gain access to more sophisticated technology, such as encryption, that makes it easier to hide evidence.

But privacy advocates have opposed such measures. They say backdoors would expand government's surveillance abilities and create security weaknesses exploitable by hackers and criminals. Those concerns have grown in recent years, as data breaches become more common and since Edward Snowden's revelations about mass surveillance.

In its San Bernardino filing on Friday, prosecutors accused Apple capitalizing on such fears to court public support.

"The government shares Apple's stated concern that 'information needs to be protected from hackers and criminals,'" the continued. "The Order at issue does not compromise that interest."

"What is at stake," they said, is a "proper, legal [judicial order] based on a finding of probable cause."

Mashable
is a global, multi-platform media and entertainment company. Powered by its own proprietary technology, Mashable is the go-to source for tech, digital culture and entertainment content for its dedicated and influential audience around the globe.